Nagios Support Forum

I'm only using alpha-numeric passwords, so that fix doesn't fit me

I'm more concerned with finding which process launchs that htpasswd with the wrong password. Tomorrow I'll post the audit logs and I'll try to find some kind of pattern because right now this is a complete random issue.

Thanks!

This has been a bit of a "ghost" issue for us as well, so if you find anything out on this, by all means let us know as well. I know that some users have reported that setting all of the security credentials passwords to be the same as their nagiosadmin password permanently fixed their graphs. However, that's not a preferred solution. If there's a process that's changing that backend password, it would make sense why that solution fixed the issue for some people though.

I'll bring up your findings at our staff meeting today, we'll see if we can kick over any more rocks on this as well.

More findings... this is the process that changes the password:

root 4556 1 4556 4556 0 Jan11 ? 00:00:03 crond
nagios 25546 4556 4556 4556 0 11:27 ? 00:00:00 crond
nagios 25555 25546 25555 25555 0 11:27 ? 00:00:00 /bin/sh -c /usr/bin/php -q /usr/local/nagiosxi/cron/reportengine.php > /usr/local/nagiosxi/var/reportengine.log 2>&1
nagios 25557 25555 25555 25555 0 11:27 ? 00:00:00 /usr/bin/php -q /usr/local/nagiosxi/cron/reportengine.php
nagios 25548 4556 4556 4556 0 11:27 ? 00:00:00 crond
nagios 25559 25548 25559 25559 0 11:27 ? 00:00:00 /bin/sh -c /usr/bin/php -q /usr/local/nagiosxi/cron/feedproc.php > /usr/local/nagiosxi/var/feedproc.log 2>&1
nagios 25562 25559 25559 25559 0 11:27 ? 00:00:00 /usr/bin/php -q /usr/local/nagiosxi/cron/feedproc.php
nagios 25549 4556 4556 4556 0 11:27 ? 00:00:00 crond
nagios 25558 25549 25558 25558 0 11:27 ? 00:00:00 /bin/sh -c /usr/bin/php -q /usr/local/nagiosxi/cron/eventman.php > /usr/local/nagiosxi/var/eventman.log 2>&1
nagios 25561 25558 25558 25558 0 11:27 ? 00:00:00 /usr/bin/php -q /usr/local/nagiosxi/cron/eventman.php
nagios 25550 4556 4556 4556 0 11:27 ? 00:00:00 crond
nagios 25564 25550 25564 25564 0 11:27 ? 00:00:00 /bin/sh -c /usr/bin/php -q /usr/local/nagiosxi/cron/cmdsubsys.php > /usr/local/nagiosxi/var/cmdsubsys.log 2>&1
nagios 25565 25564 25564 25564 0 11:27 ? 00:00:00 /usr/bin/php -q /usr/local/nagiosxi/cron/cmdsubsys.php
nagios 25682 25565 25564 25564 0 11:27 ? 00:00:00 /bin/bash /usr/bin/htpasswd -b /usr/local/nagiosxi/etc/htpasswd.users nagiosadmin ***WRONG PASSWORD***
nagios 25684 25682 25564 25564 0 11:27 ? 00:00:00 ps -ejfH

It's just the same proc that changes password from webform...

Digging into nagiosxi db i found this entry in the xi_commands table:
command_id | group_id | submitter_id | beneficiary_id | command | submission_time | event_time | frequency_type | frequency_units | frequency_interval | processing_time | status_code | result_code | command_data | result
------------+----------+--------------+----------------+---------+----------------------------+----------------------------+----------------+-----------------+--------------------+----------------------------+-------------+-------------+-------------------------------------------------------------------------+--------
274 | 0 | 18 | 0 | 1100 | 2011-01-19 11:27:27.992202 | 2011-01-19 11:27:27.992202 | 0 | 0 | 0 | 2011-01-19 11:27:28.943427 | 2 | 0 | a:2:{s:8:"username";s:11:"nagiosadmin";s:8:"password";s:9:"***WRONG_PASSWORD***";} |

So... what is sending this command to the queue? >_< I'm stuck

I passed your findings on to our lead developer. This was an issue that we thought we fixed in a previous release, but we may have missed something somewhere. We'll let you know what we find.

It looks like the performance graph code is trying to authenticate to PNP as the "nagiosadmin" user instead of "nagiosxi". The attached script should fix this.

Upload the script to the following directory on your Nagios XI server:
and run it with the following commands:

Once you run the script, you might have to reset the Nagios Core backend password again the admin interface.

Let us know what happens once you've applied this fix.